> For the complete documentation index, see [llms.txt](https://kmanu225.gitbook.io/cs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kmanu225.gitbook.io/cs/software-engineering/compatibility/vhd-backups.md).

# VHD Backups

Windows system backups are stored as **VHD** files (Virtual Hard Disk), one per volume. A VHD is just a whole disk packed into a single file, so you can open it and copy files out without reinstalling Windows, restoring the backup, or booting a VM.

A typical backup looks like this:

```
WindowsImageBackup/
└── User-PC/
    ├── Backup 2019-02-22 124351/
    │   ├── 9b9cfbc3-....vhd   # small system-reserved (boot) volume
    │   ├── 9b9cfbc4-....vhd   # main C: volume (Windows + user files)
    │   └── BackupSpecs.xml
    ├── Catalog/
    └── MediaId
```

The main `C:` volume is usually the larger file. Each VHD is independent, so you open only the one you need.

This page covers three ways to open a VHD: **qemu-nbd** (manual, full control), **guestmount** (one command), and **7-Zip on Windows** (no mounting at all). Whichever you use, work **read-only** so the backup stays intact for data recovery or forensics.

## Method 1: qemu-nbd (Linux)

`qemu-nbd` exposes the VHD as a normal Linux block device (`/dev/nbd0`), after which you mount its NTFS partition like any other disk.

**1. Install the tools** (Debian/Ubuntu):

```bash
sudo apt install qemu-utils ntfs-3g
```

**2. Load the NBD kernel module.** NBD (Network Block Device) can also map a local disk image to a block device:

```bash
sudo modprobe nbd max_part=16
```

**3. Attach the VHD** read-only, telling QEMU it is a Microsoft VHD (`vpc`):

```bash
sudo qemu-nbd --read-only --format=vpc --connect=/dev/nbd0 backup.vhd
```

**4. Find the partitions:**

```bash
lsblk -f /dev/nbd0
```

```
NAME       FSTYPE LABEL
nbd0
└─nbd0p1   ntfs   Windows
```

**5. Mount it** read-only:

```bash
sudo mkdir -p /mnt/windows
sudo mount -t ntfs-3g -o ro /dev/nbd0p1 /mnt/windows
ls /mnt/windows/Users
```

> If the VHD has no partition table (the filesystem sits directly on the disk), mount `/dev/nbd0` instead of `/dev/nbd0p1`.

**Multiple VHDs:** attach each to its own device, then mount separately:

```bash
sudo qemu-nbd -r -f vpc -c /dev/nbd0 disk1.vhd
sudo qemu-nbd -r -f vpc -c /dev/nbd1 disk2.vhd
lsblk -f /dev/nbd0 /dev/nbd1
```

**Clean up** when done, in order:

```bash
sudo umount /mnt/windows
sudo qemu-nbd --disconnect /dev/nbd0
```

## Method 2: guestmount (Linux, one command)

`guestmount` (from `libguestfs`) handles the block device, partition detection, and filesystem mount in a single step, so you skip the `modprobe`/`qemu-nbd`/`lsblk` dance.

```bash
sudo apt install libguestfs-tools
guestmount --add backup.vhd --inspector --ro -v /mnt/windows
```

What the options do:

* `--add <vhd>`: the disk image to open.
* `--inspector` (`-i`): auto-detect the operating system and mount its main filesystem at the mount point, so you don't pick a partition by hand.
* `--ro`: read-only, same safety guarantee as qemu-nbd.
* `-v`: verbose output, handy when a VHD fails to inspect.

Then browse normally:

```bash
ls /mnt/windows/Users
```

Unmount with:

```bash
guestunmount /mnt/windows
```

Use guestmount when you just want the files fast. Use qemu-nbd when you need explicit control, for example to pick a specific partition or run disk tools against the device.

## Method 3: 7-Zip (Windows)

If you are already on Windows, you often don't need to mount anything: **7-Zip opens a VHD like an archive** and lets you extract files directly.

1. Install [7-Zip](https://www.7-zip.org/).
2. Right-click the `.vhd` file -> **7-Zip** -> **Open archive**.
3. Browse into the volume and drag out the files you need.

This is read-only by nature (extracting copies files out without writing back), needs no admin tools, and works even on a VHD whose filesystem Windows would otherwise refuse to attach. For a quick peek or pulling a few files, it is the fastest option on Windows.

> Native Windows can also mount a VHD: **Disk Management -> Action -> Attach VHD** (tick *Read-only*), or `Mount-VHD -Path backup.vhd -ReadOnly` in PowerShell. 7-Zip is handy when you only want to extract rather than assign a drive letter.

## Which method to use

| Situation                       | Best option |
| ------------------------------- | ----------- |
| On Linux, want full control     | qemu-nbd    |
| On Linux, just want the files   | guestmount  |
| On Windows, extract a few files | 7-Zip       |

All three keep the backup read-only, so you can recover data safely without altering the original image.